On 24 April 2024, President Biden signed into law H.R. 815, “Making Emergency Supplemental Appropriations for the Fiscal Year Ending September 30, 2024, and for Other Purposes” (the Act).[1] The long-awaited piece of legislation provides supplemental funding to support Ukraine, Israel, and Indo-Pacific partners. Additionally, the Act contains Division D, “The 21st Century Peace Through Strength Act” (the Sanctions Act), authorizing and, in certain instances mandating, expansion of sanctions and export controls on U.S. adversaries.[2]

In broad terms, congressional actions contained in the Sanctions Act include (1) authorizing or requiring the imposition of blocking sanctions contingent on the executive branch’s determinations; (2) extending of the statute of limitations for civil and criminal sanctions violations from 5 years to 10 years; (3) conferring legal authority to seize sovereign assets of Russian Federation; (4) ordering certain reports that may later be used as a basis for the imposition of sanctions; (5) outlining data-protection driven limitations; and (6) expanding export controls, through the foreign product rule, related to Iran.

The 21st Century Peace Through Strength Act

The Sanctions Act comprises 15 acts, each of which addresses a different threat. Each of the 15 acts is under a separate division of the Sanctions Act (i.e., a separate section) and requires U.S. government actions to address a broad spectrum of threats to U.S. national security that includes Iran, China, international terrorist organizations, and narcotics traffickers. Importantly, the Sanctions Act in certain instances codifies select provisions of relevant sanctions programs connected to each of these national security threats, which means that removing such restrictions will require congressional action. Moreover, the Sanctions Act expands the basis for U.S. secondary sanctions, providing the U.S. government with the authority to impose designations on certain foreign persons that support activity that is contrary to U.S. national security interests.

Considering the vast scope of the Act and numerous mandates to the executive branch, including the Department of the Treasury’s Office of Foreign Assets Control (OFAC), we expect to see multiple updated regulations, guidance, and other regulatory materials related to a number of sanctions programs in the upcoming months.

Expansion of the Statute of Limitations for Sanctions Violations

One of the key provisions of the Act is the expansion of the U.S. government’s authority to pursue civil and criminal enforcement actions of sanctions violations for up to 10 years after the most recent alleged violation has occurred, up from the current five-year statute of limitations. This applies to all U.S. sanctions programs (and other restrictions) imposed under the International Emergency Economic Powers Act (IEEPA) or the Trading with the Enemy Act. The section expanding the statute of limitations is very brief but will have far-reaching consequences. These consequences are likely to include:

• OFAC may require companies submitting voluntary self-disclosures (VSDs) of apparent violations of sanctions to further expand their internal investigations up to 10 years;
• OFAC may adjust its reporting and recordkeeping regulations to impose a 10-year requirement instead of the current requirement of five years;
• The expansion of the statute may shift the balance in settlement negotiations with OFAC and potentially other federal and state authorities, giving more negotiating power to these authorities;
• OFAC will need to place less reliance on negotiating tolling statute of limitations agreements (agreements in which a party that is being investigated by OFAC agrees to waive the statute of limitations to allow OFAC to investigate apparent violations that fall outside the prescribed time limit in the laws and regulations), currently a mitigating factor in OFAC settlements; and
• OFAC may impose larger fines due to the extended scrutiny period and, as a result, may issue a higher number of violations.

It is currently unclear how the U.S. government will interpret the effective date of the amendment. For example, it is unclear how the expansion will affect all current pending cases or filed VSDs or whether the government can pursue actions for conduct that occurred more than five years ago as of 24 April 2024, for which effectively the old statute of limitations has run.

Russia- and Ukraine-Related Authorities

Two divisions of the Act, “Rebuilding Economic Prosperity and Opportunity for Ukrainians Act” (REPO Act) and Division G, “Other Matters,” contain Russia-related authorities.

Rebuilding Economic Prosperity and Opportunity for Ukrainians Act

The REPO Act represents a major move in U.S. sanctions policy by allowing the U.S. president, who will in turn authorize relevant agencies, to seize or confiscate certain assets that were frozen pursuant to sanctions requirements. Among other things, the REPO Act:

• Prohibits the release of already immobilized or blocked Russian sovereign assets unless Congress authorizes such action.
  • As a reminder, by issuing Directive 4 under Executive Order (EO) 14024, OFAC already immobilized assets of the Central Bank of the Russian Federation, the Russian National Wealth Fund, and the Ministry of Finance of the Russian Federation. Starting from June 2023, OFAC requires U.S. holders of such assets to submit annual reports.
• Allows the president to expand the congressional definition of “Russian aggressor state” (to target other assets for seizure) to include:
  • Any subdivision, agency, or instrumentality of the government of Russia, in addition to the above-mentioned Directive 4 agencies; and
  • Belarus and its government with its agencies and instrumentalities.
• Provides the authority to seize, confiscate, transfer, or vest any “Russian aggressor state” sovereign assets, in whole or in part, and including any interest or interests in such assets, subject to the jurisdiction of the United States for the purpose of transferring those funds to a newly created Ukraine Support Fund.
• Mandates the president to engage in close cooperation with other leaders in the Group of Seven, which includes Canada, France, Germany, Italy, Japan, and the United Kingdom, to act multilaterally when it comes to any seizure, confiscation, vesting, or transfer of Russian sovereign assets for the benefit of Ukraine. The president shall also work with partners and allies toward creating an international reconstruction fund, the Ukraine Compensation Fund.
• Requires several executive branch agencies to submit periodic reports to Congress linked to such assets and their use.

Some other notable points under the REPO Act:

• It has a sunset provision to occur either within five years from the enactment or when peace is reached, and Russia undertakes to compensate Ukraine.
• It provides notable statistics concerning the currently immobilized or frozen Russian state assets:
  • Approximately $300 billion of Russian sovereign assets have been immobilized worldwide.
    • Only a small fraction of those assets—one to two percent, or between $4 billion to $5 billion—are reportedly subject to the jurisdiction of the United States.
    • The vast majority of the assets—approximately $190 billion—are reportedly subject to the jurisdiction of Belgium. The government of Belgium has publicly indicated that any action it undertakes regarding these assets would be predicated on support by the G7.

Further Harmonizing Sanctions-Related Efforts

In the “Other Matters” division of the Act, Congress mandated the executive branch to apply efforts to further harmonize sanctions imposed on Russia and its actors (but not Belarus) by the European Union (EU) and the United Kingdom (UK).

Specifically, within 90 days of the Act’s enactment, the U.S. Department of the Treasury is required to submit a report to Congress comparing its list of designated parties with those of the EU and UK and identifying persons currently not designated by OFAC but that meet various existing U.S. designation criteria. Following the report, the president may (but is not required to) impose sanctions on EU and UK designated parties that are not currently sanctioned in the United States.

Technology- and Data-Related Authorities

Two divisions of the Act address emerging technology- and data-related threats to the national security of the United States.

Protecting Americans from Foreign Adversary Controlled Applications Act

This division of the Act effectively prohibits certain applications controlled by “foreign adversaries” unless an entity that owns or controls the application divests its interests within 270 days. Congress defines “foreign adversaries” to include China, Russia, Iran, and North Korea. “Control” by foreign adversary means a company or entity that is:

1. Domiciled, headquartered, or maintains its principal place of business in the targeted country;
2. An entity in which such foreign person(s) from paragraph (a) own at least a 20 percent stake; or
3. An entity subject to the direction or control of persons described in (a) or (b).

While this division has been drafted specifically to restrict TikTok, a U.S.-based subsidiary of ByteDance Ltd. in China, the text of the section was kept broad to allow the president to target future similar applications.

In order to achieve this goal, the division prohibits, within the land or maritime borders of the United States, any of the following, subject to a penalty of $5,000 per user:

• Providing services to distribute, maintain, or update such foreign adversary-controlled application (including any source code of such application) by means of a marketplace (including an online mobile application store) through which users within the land or maritime borders of the United States may access, maintain, or update such application (subject to a penalty of $5,000 per user per day).
• Providing internet hosting services to enable the distribution, maintenance, or updating of such foreign adversary-controlled application for users within the land or maritime borders of the United States.

The restrictions on TikTok will come to effect 270 days after the enactment of the Act (i.e., January 19, 2025), which date can be postponed for up to 90 days if certain conditions are met, such as an advanced sales agreement and/or advanced stages of divestment in place.

In anticipation of pushback from TikTok, the division provides that any judicial challenge to its provisions must be brought before the U.S. Court of Appeals for the District of Columbia.[3] In addition, the Act also requires the restricted application to provide all users the ability to download all their data, such as personal data, created content, and account information. Failure to do so will result in a penalty of $500 per user.

Protecting Americans’ Data from Foreign Adversaries Act of 2024

This division of the Act prohibits data brokers from making the personally identifiable sensitive data of a U.S. individual available to:

• Any foreign adversary country; or
• Any entity that is controlled by a foreign adversary.

The term “foreign adversary country” is defined the same as in the Protecting Americans from Foreign Adversary Controlled Applications Act and includes China, Russia, Iran, and North Korea.

Of note, the term “data broker” includes any entity that for consideration sells, licenses, rents, trades, transfers, or otherwise provides access to data of U.S. individuals, but excludes any entities that collect such data directly from users.

Iran-Related Provisions

Six divisions of the Act are dedicated to further sanctions and other restrictive measures against Iran or foreign persons supporting certain Iran-related activities.

Stop Harboring Iranian Petroleum Act (the SHIP Act)

The SHIP Act effectively expands secondary sanctions authorities and requires the executive branch to continue to target persons facilitating shipping, refinery, or other activities involving Iranian-origin oil.

The SHIP Act requires the president to impose blocking sanctions and visa bans on individuals and entities determined to knowingly:

• Own or operate a foreign port and allowing a vessel to dock:
  • If such vessel appears on the list of Specially Designated Nationals (SDNs) for transporting Iranian oil or petroleum products; or
  • If the operator or owner of such vessel otherwise knowingly engages in significant transactions in petroleum products originating in Iran;
• Own or operate a vessel that engages in ship-to-ship transfers of Iranian petroleum products; or
• Own or operate a refinery that processes, refines, or otherwise deals in any Iranian-origin petroleum products.

Additionally, the president is empowered to prohibit landing of vessels that engage in ship-to-ship transfer of Iranian petroleum at any port in the United States for a maximum of two years from the date of engaging in sanctionable activity under this act.

These restrictions significantly increase U.S. government expectations on port and vessel owners and operators, which are now required to conduct certain due diligence and implement “know your customer” or “know your business” measures or otherwise expose themselves to a threat of U.S. blocking sanctions.

Furthermore, Congress requests different parts of the executive branch to submit robust periodic reports regarding Iran’s export of petroleum and petroleum products. Lastly, Congress mandates the U.S. Secretary of State to submit a written strategy on countering China’s evasion of U.S. sanctions with respect to Iranian petroleum products.

Iran-China Energy Sanctions Act of 2023

The Iran-China Energy Sanctions Act intends to increase the pressure on Chinese financial institutions that engage in activities related to Iranian petroleum or petroleum products. Accordingly, it extends the scope of existing secondary sanctions by waiving the requirement that financial transactions by Chinese banks have to be significant in order to be sanctionable by the U.S. government. Now a Chinese bank can be targeted for engaging in any transaction that involves the purchase of petroleum products from Iran.

Unrelatedly, but in the same section, the Iran-China Energy Sanctions Act expands the scope of secondary sanctions to cover all foreign financial institutions (FFIs) that engage in significant transactions involving the purchase of Iranian unmanned aerial vehicles (UAVs), UAV parts, or related systems. Again, such transactions do not need to be significant, and any transaction—regardless of size, number, frequency, or nature—can expose FFIs to the risk of U.S. sanctions.

Fight and Combat Rampant Iranian Missile Exports Act (Fight CRIME Act)

The U.S. government has issued numerous guidance and designations to continue to interrupt illicit networks helping Iran to produce and sell UAVs and other arms and related materiel, including to Russia, Yemen, and other rogue regimes.

In order to further counter such activities, the Fight CRIME Act expands secondary sanctions and requires the president to impose sanctions (blocking sanctions and visa bans) on any foreign person that knowingly engages in any of the following five sanctionable activities:

• Engaging in efforts to acquire, develop, transport, or transfer “covered technology” to, from, or involving the government of Iran or Iran-aligned entities;
• Providing the government of Iran or Iran-aligned entities with goods, technology, parts, or components that may be used in the covered technology;
• Participating in joint missile or drone development with the government of Iran or Iran-aligned entities;
• Importing, exporting, or re-exporting to, into, or from Iran any significant arms or related materiel; or
• Providing significant financial, material, or technological support to or engaging in significant transactions with persons designated under the provisions of the act.

The term “covered technologies” refers to any goods, technology, software, or related materiel currently listed in the Missile Technology Control Regime Annex,[4] or as may be amended in future.

The Fight CRIMIE Act also explicitly states that the United States will continue to target and disrupt Iran’s domestic ballistic missile production capabilities despite the fact that related United Nations Security Council Resolution measures expired in October 2023.

It also requires the Secretary of State to submit a comprehensive report to Congress that, among other things, must analyze the foreign and domestic supply chains in Iran that directly or indirectly facilitate, support, or otherwise aid the government of Iran’s drone or missile program, including storage, transportation, or flight-testing of related goods, technology, or components.

No Technology for Terror Act

The No Technology for Terror Act expands the scope of U.S. export controls restrictions for items destined for Iran or the government of Iran. As a reminder, U.S. export control restrictions attach to a good or technology; thus, the expansion primarily addresses foreign persons that manufacture certain goods using U.S. technology and then export such items to Iran or Iranian proxies.

Pursuant to this act, the U.S. Department of Commerce will now prohibit a broader category of certain foreign-produced items from being exported, re-exported, or in-country transferred to Iran 90 days after the enactment of the Act, i.e., July 23, 2024. Foreign products in scope of the foreign direct product rule include certain non-U.S.-made items that are the direct product of U.S.-origin technology or software or that are produced in a foreign plant, so long as the plant itself is a product of U.S.-origin technology or software.

Holding Iranian Leaders Accountable Act

This authority is similar to the reporting and FFI sanctioning requirement the Congress imposed on the President under the Hong Kong Autonomy Act of 2020.

Specifically, Congress requires the president, within 180 days from the enactment of the Act, to submit a report listing the assets held by certain high-level officials in Iran or terrorist groups supported by Iran and an explanation regarding how these assets were acquired. More importantly, the report must list non-Iranian financial institutions that maintain an account for these persons or provide significant financial services to them. If a non-Iranian financial institution is identified in this report, then OFAC should actively seek the closure of any relevant account and termination of services (and in case of identified U.S. financial institutions, which is highly unlikely, to require the closure and termination of the account or service).

Mahsa Amini Human Rights and Security Accountability Act (Mahsa Act)

In response to human rights abuses of the government of Iran, notably the killing in 2022 of Mahsa Amini, a22-year-old Iranian woman in police custody, Congress introduced a bill named in her memory. The bill, which is now law, requires the executive branch to submit reports and identify certain persons in Iran that are engaged in human right abuses (e.g., the Office of Iran’s Supreme Leader and his appointees). The president then must impose sanctions under the various Iran-related sanctions authorities on the persons identified in the report.

Terrorism, Narcotics Trafficking, and Other Measures

Fentanyl Eradication and Narcotics Deterrence Off Fentanyl (FEND Off Fentanyl Act)

Under this division of the Act, Congress requires the president to submit a report that describes all the actions taken (or to be taken) by the executive branch pursuant to the FEND Off Fentanyl Act and any national emergency declared with respect to the trafficking of fentanyl and trade in other illicit drugs.

Section 3103 of the FEND Off Fentanyl Act requires the president to impose blocking sanctions against any foreign person the president determines:

• Is knowingly involved in the significant trafficking of fentanyl, fentanyl precursors, or other related opioids, including such trafficking by a transnational criminal organization; or
• Otherwise is knowingly involved in significant activities of a transnational criminal organization relating to the trafficking of fentanyl, fentanyl precursors, or other related opioids.

Sections 3112, 3113, and 3114 of the FEND Off Fentanyl Act require the director of OFAC and the Secretary of the Treasury to produce reports about staffing at OFAC, drug transportation routes, and actions of China with respect to persons involved in fentanyl supply chain, respectively.

Hamas and Other Palestinian Terrorist Groups International Financing Prevention Act

The Hamas and Other Palestinian Terrorist Groups International Financing Prevention Act requires the President to impose blocking sanctions on foreign persons that knowingly support acts of terrorism or engage in significant transactions with senior members of Hamas, Palestinian Islamic Jihad, and other Palestinian terrorist organizations.

The Congress also required the president to impose restrictions, including certain export controls, against foreign states that provide support to Hamas, Palestinian Islamic Jihad, and other Palestinian terrorist organizations.

Strengthening Tools to Counter the Use of Human Shields Act

The Strengthening Tools to Counter the Use of Human Shields Act accomplishes the following:

• Requires the president to impose sanctions on the members of Palestine Islamic Jihad or persons acting on its behalf;
• Codifies presidential authority to impose blocking sanctions and travel bans on any foreign person that has knowingly engaged in significant cyber-enabled activities that threaten the national security or policy of the United States as well as persons providing material assistance to such activities; and
• Requires the president to impose blocking sanctions and travel restrictions on any foreign person the president determines has ordered, directed, or taken material steps to carry out any use of violence or has attempted or threatened to use violence against any current or former official of the government of the United States.

Illicit Captagon Trafficking Suppression Act

Pursuant to this division of the Act, in order to counter Bashar al-Asad’s regime in Syria—which benefits from the illicit trafficking in captagon, an amphetamine-type stimulant—Congress requires the president to impose blocking sanctions and travel restrictions on foreign persons determined to be engaged in activities or transactions that have materially contributed to the illicit production and international illicit proliferation of captagon.

End Financing for Hamas and State Sponsors of Terrorism Act

The Congress, under this division of the Act, requires the Secretary of the Treasury to develop a strategy in coordination with U.S. allies and partners to ensure that Hamas is incapable of financing armed hostilities against Israel.

Key Takeaways

The Act will have far-reaching consequences for many market participants. These consequences likely will include:

• Expanding the statute of limitations regarding sanctions-related violations from five years to 10 years will provide U.S. government agencies such as OFAC with much more flexibility when bringing an enforcement action. This may also shift the calculus of certain companies considering whether or not they should file a VSD. We may also see amendments to various U.S. government regulations expanding recordkeeping requirements to increase the required period to 10 years.
• Considering the number of new and amended sanctions, OFAC, the Department of the Treasury’s Financial Crime Enforcement Network, and other U.S. government agencies will likely issue numerous changes to their rules and regulations, as well as guidance and notices in the upcoming several months.
• Under the REPO Act, the executive branch may confiscate certain Russian state-owned assets. Authority to do so may convince other G7 leaders that such actions are necessary to help Ukrainian reconstruction efforts. In response, however, the government of Russia is likely to continue seizing assets of foreign “unfriendly states” in Russia, like it did with several companies starting from summer of 2023. Businesses continuing to operate in Russia are thus exposed to ever increasing risks that may affect their operations.
• The Act significantly expands the basis for U.S. secondary sanctions, and foreign persons will need to increase their efforts on conducting sanctions risks assessments and implementing know your customer or know your business rules to ensure they are not engaged in such proscribed activities.
• The Act requires the U.S. Department of the Treasury, the State Department, and other agencies to submit dozens of new reports to Congress identifying individuals, entities (including financial institutions), and vessels engaged in sanctionable activities. Those identified in the reports are likely to be sanctioned, if the applicable sections of the divisions require (or allow) the president to do so.
• As is the case with all congressionally mandated sanctions, the president can no longer remove a sanctions program by repealing a previously issued Executive Order; rather, such removal will require Congress to act.

[1] The White House, Presidential Actions, Press Release, “Bill Signed: H.R. 815,” April 24, 2024, available at https://www.whitehouse.gov/briefing-room/presidential-actions/2024/04/24/bill-signed-h-r-815/.

[2] H.R.815, “Making Emergency Supplemental Appropriations for the Fiscal Year Ending September 30, 2024, and for Other Purposes,” available at https://www.congress.gov/118/bills/hr815/BILLS-118hr815enr.pdf.

[3] In fact, TikTok filed a lawsuit challenging the new law on May 7, 2024. See TikTok Inc and ByteDance Ltd v. Merrick B. Garland, available at https://sf16-va.tiktokcdn.com/obj/eden-va2/hkluhazhjeh7jr/AS%20FILED%20TikTok%20Inc.%20and%20ByteDance%20Ltd.%20Petition%20for%20Review%20of%20H.R.%20815%20(2024.05.07)%20(Petition).pdf?x-resource-account=public.

[4] The Missile Technology Control Regime Annex is available at https://www.mtcr.info/mtcr-annex. The Annex list virtually all key equipment, materials, software, and technology needed for missile development, production, and operation. For more details see Missile Technology Control Regime (MTCR) Frequently Asked Questions – United States Department of State.